vpn-deployment

Files (1)

• SKILL.md

SKILL.md (first lines)

# WireGuard VPN Deployment Guide

This skill guides you through the complete WireGuard VPN deployment workflow: installing and configuring a WireGuard server on a VPS, connecting an OpenWrt router as a client via `apfree_wifidog_set_wireguard_vpn`, and managing traffic routing via `apfree_wifidog_set_vpn_routes`.

## Overview

```
VPS (WireGuard Server)                     Router (WireGuard Client)
┌──────────────────────┐                   ┌──────────────────────┐
│  wg0: 10.0.0.1/24    │◄── WG tunnel ──► │  wg0: 10.0.0.2/24    │
│  Public IP: X.X.X.X  │                   │  LAN: 192.168.1.0/24 │
│  NAT masquerade       │                   │  ip route proto static│
└──────────────────────┘                   └──────────────────────┘
         │                                          │
    Internet ◄─── selected/all traffic ────── LAN clients
```

## Phase 1: VPS WireGuard Server Setup

These are local shell commands to run on the VPS directly (not through apfree-wifidog tools).

### 1.1 Install WireGuard

Detect the distro and use the appropriate package manager:

```bash
# Debian / Ubuntu
apt update && apt install -y wireguard

# CentOS 8+ / RHEL 8+ / Rocky / AlmaLinux
dnf install -y epel-release elrepo-release
dnf install -y kmod-wireguard wireguard-tools

# CentOS 7 (requires ELRepo)
yum install -y epel-release
yum install -y https://www.elrepo.org/elrepo-release-7.el7.elrepo.noarch.rpm
yum install -y kmod-wireguard wireguard-tools

# Fedora
dnf install -y wireguard-tools

# Arch Linux
pacman -S --noconfirm wireguard-tools

# Verify
which wg && which wg-quick
modprobe wireguard && echo "wireguard module loaded"
```

> **Note:** On CentOS/RHEL with kernel < 5.6, the `kmod-wireguard` package provides the kernel module. On kernel >= 5.6 (including most CentOS 8 Stream / RHEL 9), WireGuard is built-in and only `wireguard-tools` is needed.

### 1.2 Generate Server Keys

```bash
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key
```

### 1.3 Generate Router Public Key (Secure — keys generated on router)

Instead of generating router keys on the VPS, use `apfree_wifidog_generate_wireguard_keys` to generate the key pair **on the router itself**. The private key is written directly to UCI and never leaves the device. Only the public key is returned.

```
Tool: apfree_wifidog_generate_wireguard_keys
Params:
  deviceId: "<router_device_id>"
```

Response will contain `data.public_key` — save this for the VPS `[Peer]` section below.

> **Security:** The router's private key never traverses the network (MQTT/WebSocket). It is generated locally by `wg genkey` and stored in UCI `network.wg0.private_key`.

### 1.4 Create Server Configuration

```bash
cat > /etc/wireguard/wg0.conf << 'EOF'
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT

[Peer]
# Router 1
PublicKey = <router1_public_key>
AllowedIPs = 10.0.0.2/32, 192.168.1.0/24
EOF
```

**Important:** Replace `eth0` with the actual public-facing interface name (`ip route get 1.1.1.1 | awk '{print $5}'`).

### 1.5 Enable IP Forwarding

```bash
# Check current state
sysctl net.ipv4.ip_forward

# Enable persistently (works on all distros)
sed -i '/^net.ipv4.ip_forward/d' /etc/sysctl.conf
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p
```

### 1.6 Firewall Configuration

Open the WireGuard listen port. Detect which firewall is active:

```bash
# If firewalld is active (CentOS/RHEL/Fedora default)
if systemctl is-active --quiet firewalld; then
  firewall-cmd --permanent --add-port=51820/udp
  firewall-cmd --permanent --add-masquerade
  firewall-cmd --reload
# If ufw is active (Ubuntu/Debian default)
elif command -v ufw &>/dev/null && ufw status | grep -q "active"; then
  ufw allow 51820/udp
# Otherwise ensure iptables rules in wg0.conf PostUp/PostDown handle it
else

From Arry8/openclaw-edge, MIT.

More from Arry8/openclaw-edge